Web3 pre-click safety check
Drop the link in first.
Then decide whether to click.
Submit a suspicious link, repository, package or download. Preflight retrieves and analyses it in an isolated environment, evaluates it against Web3-specific threat indicators — seed-phrase theft, wallet-extension hijacking, address swapping, supply-chain poisoning — and returns an actionable verdict before anything reaches your device.
Engine status
Full roadmapStatic analysis engine
- Isolated fetch & redirect resolution
- Phishing blocklists · domain intelligence
- Repository & package audit
- Web3 rule engine · AI explanation
Isolated execution sandbox
- File upload · hash / YARA
- Linux & Windows containers
- Wallet-path, clipboard & network monitoring
- Behavioural scorecard
Why pre-click
Losses happen in the second you click.
Antivirus and EDR shine after a file lands or runs. Web3 teams lose keys on the first click: a fake interview assignment, a poisoned repository, a cracked tool, a second-stage downloader.
The time gap
Local scanners step in after download or execution. Preflight moves the decision to T-1: the server fetches, unpacks and analyses the sample so you never have to.
Lists miss the new
Browser blocklists only know yesterday's domains. New redirects and malicious assignments hosted on legitimate platforms slip through.
Reports in Web3 language
Generic sandboxes return malware family names. Preflight answers the question you actually have: will it steal MetaMask, will it swap my withdrawal address.
Pipeline
Seven steps, one verdict.
Every submission runs the same pipeline. The isolated-execution stage joins with MVP-1; the other six stages produce today's verdict.
- 01
Submit
Paste a link or upload a file. Optional context ("interview task", "tool from Telegram") adjusts detection weights.
- 02
Safe fetch
Server follows redirects with a cap, verifies MIME and magic bytes, unpacks nested archives and deduplicates by hash.
- 03
Static pre-check
Hash intelligence, YARA, script and lockfile audit, extension manifest permissions, entropy and obfuscation features.
- 04
Isolated execution
Windows / macOS / Linux sandboxes watch wallet paths, clipboard, process tree and DNS/HTTPS.
- 05
Web3 rule engine
Behaviour is mapped to the scorecard; a lethal hit short-circuits straight to High risk.
- 06
AI summary
Plain-language conclusion and next steps, generated only from collected evidence — no guessing.
- 07
Deliver
Shareable report plus copyable IOCs. Enterprise: webhook / Slack. Samples never return to your machine.
Not sure about that link? Don't open it yet.
Check a link
Scorecard
Six questions a Web3 user actually asks.
The report ranks findings by how you lose money, not by malware family. Analysts still get IOCs and the evidence chain.
Seed / private-key theft
Searches for or exfiltrates mnemonics, keystores, .env, PEM or SSH material.
Browser-wallet risk
Touches wallet extension data or pushes you into approvals, Permit2 or dangerous signatures.
Clipper risk
Monitors the clipboard and rewrites wallet addresses.
Exchange session hijack
Steals logged-in sessions or overlays a fake withdrawal / 2FA screen.
Supply-chain install
Install scripts, lifecycle hooks or dependencies that hide execution.
Persistence & evasion
Stays resident, cleans traces, detects sandboxes or hides behind obfuscation.
Threat model
What Preflight is built to catch.
Initial access and credential theft that start with you opening external content — not post-breach APT forensics.
| Threat | Typical lure | Web3 consequence |
|---|---|---|
| Fake recruiting / Contagious Interview | Coding-assignment Git repo, setup script | Dev machine compromised → wallet / CI credentials |
| Supply-chain poisoning | Malicious npm / Homebrew / Terraform provider | Executes on install, steals keys |
| Phishing domains & redirects | Lookalike sites, short links, HTML smuggling | Wallet connect / seed import |
| Clipper | Cracked apps, bundled installers | Copied address silently replaced |
| Extension poisoning | "Security helper" .crx | Reads extension wallets, CDP hijack |
| Documents / installers | dmg / pkg / exe, macro documents | RAT / stealer lands |
| Session & overlay | Injection into logged-in exchange pages | Fake 2FA, silent withdrawal |
Token & quota
Hold for quota. Burn for priority.
The check itself never needs a wallet. Holding PREFLIGHT raises your daily quota; burning it buys extra credits and queue priority once the sandbox is live.
Price
Pending launch
Market cap
–
Burned
0
0% of supply
Total supply
–
Daily quota by holdings
| Holding | Checks / day |
|---|---|
| No wallet | 3 |
| Connected wallet | 5 |
| ≥ 1M PREFLIGHT | 20 |
| ≥ 10M PREFLIGHT | 100 |
Burn boost
Every 100K PREFLIGHT sent to the dead address adds one extra check credit to your wallet. Credits never expire. Burns are verified from the transaction receipt — no contract, no approval.
Not sure about that link? Don't open it yet.
Paste it into Preflight first. Three free checks a day, no account, no wallet.